← Back

CVE-2025-63685

nvd nist
Published: Nov 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of [regsvr32.exe] it loads. An attacker can place a crafted malicious DLL in the application's startup directory, which will be loaded and executed when the user launches the program.

Affected (1)

Quark
1 product
Quark Cloud Drive
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Quark Cloud Drive
Version 3.23.2

Related CWEs

CWE-491
Public cloneable() Method Without Final ('Object Hijack')
A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.

References (1)

Source: cve@mitre.org
ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.